Information Technology and Digital Governance
What this domain tests
Information Technology and Digital Governance tests board-level technology oversight, IT controls, cyber risk, data protection, and the legal framework for electronic records and signatures.
Core rules and concepts
- IT governance aligns technology with strategy and manages risk; COBIT is a recognised governance framework. The CIA triad is confidentiality, integrity, and availability.
- Controls include least privilege, multi-factor authentication, segregation of duties, change management, tested backups, logging, and incident response.
- The IT Act, 2000 recognises electronic records and digital signatures and provides a framework for cyber offences. The DPDP Act, 2023 governs personal-data processing through consent, purpose limitation, and data-principal rights.
- CERT-In directions require reporting of specified cyber incidents within six hours; boards should ensure escalation and evidence preservation.
Worked example
A company suffers ransomware. The response should isolate affected systems, activate the incident-response plan, preserve logs, notify the appropriate authorities within the required timeline, and restore from tested offline backups. Paying the ransom is not a control and does not remove legal, reputational, or data-protection obligations.
Traps that cost marks
Do not treat encryption or a firewall as complete security. Do not assume backups are effective without restoration testing. Do not let IT incident response bypass legal privilege, breach notification, or board reporting. Do not confuse the DPDP Act’s consent regime with the IT Act’s electronic-signature provisions.